---
id: CVE-2026-44584
title: Paymenter doesn't reset email verification status after email change
summary: Paymenter doesn't reset email verification status after email change
severity: medium
cvss: 4.3
cwe:
  - CWE-287
vendor: paymenter
product: paymenter/paymenter
ecosystem: composer
affected:
  - paymenter/paymenter < 1.5.0
patched:
  - paymenter/paymenter 1.5.0
published: '2026-06-22'
updated: '2026-06-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-rv89-wch8-c574'
references:
  - url: >-
      https://github.com/Paymenter/Paymenter/security/advisories/GHSA-rv89-wch8-c574
  - url: 'https://github.com/advisories/GHSA-rv89-wch8-c574'
tags:
  - ghsa
  - composer
ingestedAt: '2026-06-29T13:24:35.512Z'
epss: 0.00163
epssPercentile: 0.05918
---

## Overview

### Summary
The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address.

### Technical Details
When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed.

This allowed an attacker to:

- Verify an account using a legitimate email address
- Change the account email to an arbitrary or unowned address
- Retain the verified status without re-confirmation of the new email

No verification challenge or confirmation was required for the newly assigned email address.

### Impact
This vulnerability allows a user to associate a verified account with an email address they do not control, this may result in:

- Misrepresentation of email ownership
- Bypass of verification-based trust assumptions
- Potential abuse of features gated behind verified status

No direct unauthorized access to other users accounts or data is possible through this issue alone.

## Affected packages

- `paymenter/paymenter < 1.5.0`

## Remediation

Upgrade to a patched release:

- `paymenter/paymenter 1.5.0`